Persistent Threat Research Articles

Using Chia Blockchain Technology for Department of Defense Systems

The United States faces an escalating cybersecurity challenge, with national assets increasingly vulnerable to sophisticated attacks. The ever-reducing barriers to entry in the cyber realm, coupled with advanced persistent threats, underscore the critical imperative to fortify the defense of U.S. assets. Blockchain technology, pioneered by Satoshi Nakamoto over a decade ago, emerges as a resilient cryptographic solution capable of safeguarding data and assets from threats both within and outside a network. This paper delves into the potential of the Chia blockchain as a strategic ally for the Department of Defense (DoD) in bolstering its cybersecurity measures. Beyond a theoretical exploration, the paper provides tangible use cases that illustrate the practical application of Chia within the DoD framework. Notably, the examination extends to crucial areas such as financial auditing, identification management, and supply chain oversight, showcasing the versatility and efficacy of Chia in addressing multifaceted challenges faced by the DoD. Disclaimer: The views expressed are those of the author and do not reflect the official policy or position of the US Air Force, Department of Defense or the US Government.

Complexity of Contemporary Indicators of Compromise

The cybersecurity landscape has undergone substantial transformation, especially in the sphere of Advanced Persistent Threats (APT). These evolving threats, marked by increased sophistication, scale, and impact, require the critical revaluation of traditional security models and the development of more advanced defensive strategies. This study offers a comprehensive analysis of the progress in APT attack methodologies over the past 30 years, focused on the evolving nature of compromise (IoCs) and their role in shaping future predictive and defensive mechanisms. Using a rigorous methodological approach, this survey systematically reviewed 21 significant APT incidents that span three decades. This includes integrating data from various sources such as academic journals, specialised cybersecurity blogs, and media reports. Using comparative and analytical methods, this study dissects each incident to provide an intricate understanding of the APT landscape and the evolution of IoCs. Our findings indicate a notable change in thinking from isolated hacker activities to organised state-sponsored APT operations driven by complex motives such as political espionage, economic disruption, and national security interests. Advancements in APTs are characterised by sophisticated persistence mechanisms, innovative attack vectors, advanced lateral movement within networks, and more covert data exfiltration and evasion methods.This study emphasises the difficulties in detecting advanced persistent threat (APT) activities due to their sophisticated and secretive nature. This stresses the importance of thoroughly investigating the evidence of such activities and highlights the need for a dynamic and initiative-cybersecurity approach. This study also highlights the crucial role of integrating IoC understanding into AI-driven predictive models and frameworks to predict potential APT. This integration is essential for the development of pre-emptive defence strategies. This study provides valuable information on the evolving dynamics of cyber threats and emphasises the urgent need for forward-thinking adaptive cybersecurity strategies. It offers a framework for understanding the complexities of modern APTs and guides the development of more effective AI-enhanced defence mechanisms against emerging cyber threats.

Pink Bollworm management in cotton: Challenges, innovations, and sustainable solutions

Pink bollworm (Pectinophora gossypiella) poses a significant threat to cotton production worldwide. Despite the initial success of Bt cotton, resistance has emerged, necessitating alternative management strategies. Integrated Pest Management (IPM) approaches, including mating disruption and the sterile insect technique (SIT), offer promising solutions. The SPLAT (Specialized Pheromone and Lure Application Technology) technique utilizes wax-based formulations to disrupt pink bollworm mating behaviour, reducing population growth and damage to cotton crops. Meanwhile, SIT utilizes radiation to induce sterility in pink bollworm populations, reducing reproductive rates and mitigating infestation levels. Embracing these innovative strategies collectively ensures sustainable cotton cultivation, safeguarding farmers' livelihoods and reinforcing resilience against the persistent threat of the pink bollworm. Keywords: Pectinophora gossypiella, Cotton, IPM, SPLAT, STI

What proteomics has taught us about honey bee (Apis mellifera) health and disease.

The Western honey bee, Apis mellifera, is currently navigating a gauntlet of environmental pressures, including the persistent threat of parasites, pathogens, and climate change - all of which compromise the vitality of honey bee colonies. The repercussions of their declining health extend beyond the immediate concerns of apiarists, potentially imposing economic burdens on society through diminished agricultural productivity. Hence, there is an imperative to devise innovative monitoring techniques for assessing the health of honey bee populations. Proteomics, recognized for its proficiency in biomarker identification and protein-protein interactions, is poised to play a pivotal role in this regard. It offers a promising avenue for monitoring and enhancing the resilience of honey bee colonies, thereby contributing to the stability of global food supplies. This review delves into the recent proteomic studies of A. mellifera, highlighting specific proteins of interest and envisioning the potential of proteomics to improve sustainable beekeeping practices amidst the challenges of a changing planet.

Carboxymethyl hemicellulose/sorbitol/gallic acid green composite films for fresh fruit preservation

Fruits are prone to deterioration during transportation and preservation, while conventional packaging materials generally pose a persistent threat to the environment. In the present study, a multifunctional green composite film was developed using solution casting method through the interactions of hydrogen bonds among carboxymethyl hemicellulose, sorbitol, and gallic acid, which was subsequently employed as functional materials for fresh fruit preservation application. In particular, the influence of the degree of substitution (DS) of carboxymethyl hemicellulose on the properties of the composite films was investigated. The results indicated that as the DS increased, the carboxymethyl hemicellulose/sorbitol/gallic acid composite film demonstrated a notable improvement in transmittance, air barrier property, and antibacterial activity. Specifically, the composite film (DS = 0.59) showed a 42.54 % increase in transmittance and a 48.31 % decrease in air permeability compared to the composite film containing hemicellulose (control sample). Furthermore, the composite film (DS = 0.59) displayed a desired inhibition effect against Staphylococcus aureus. Based on the 9-day blueberry preservation test, the composite film (DS = 0.59) exhibited a weight loss rate of 15.36 %, whereas the blank group retained a value up to 20.34 %. In addition, the increased DS was found to lead to the decreased tensile strength but improved elongation at break. Overall, the carboxymethyl hemicellulose/sorbitol/gallic acid green composite films, derived from natural bio-materials and free of environmental concerns, could hold great promise as a novel packaging material for fresh fruit preservation.

Analysis of neural network detectors for network attacks

While network attacks play a critical role in many advanced persistent threat (APT) campaigns, an arms race exists between the network defenders and the adversary: to make APT campaigns stealthy, the adversary is strongly motivated to evade the detection system. However, new studies have shown that neural network is likely a game-changer in the arms race: neural network could be applied to achieve accurate, signature-free, and low-false-alarm-rate detection. In this work, we investigate whether the adversary could fight back during the next phase of the arms race. In particular, noticing that none of the existing adversarial example generation methods could generate malicious packets (and sessions) that can simultaneously compromise the target machine and evade the neural network detection model, we propose a novel attack method to achieve this goal. We have designed and implemented the new attack. We have also used Address Resolution Protocol (ARP) Poisoning and Domain Name System (DNS) Cache Poisoning as the case study to demonstrate the effectiveness of the proposed attack.

Assessing the Vulnerabilities: Cybersecurity Challenges in Power System Infrastructure in Nigeria

This study examined the Cyber security Challenges in Power System Infrastructure in Nigeria. Four research questions guided the study which employed a survey research design. The population of the study was 46 respondents comprising 23 Technical Units Heads and 23 Heads of Cyber security Units from the (23) power-generating plants in Nigeria. The entire population was used hence, there was no sampling. The instrument used for data collection was a structured questionnaire titled: Cyber security Challenges in Power System Infrastructure Questionnaire (CCPSIQ) developed by the researchers. A reliability index of 0.89 was obtained using the Cronbach Alpha reliability method. The mean statistic was used to answer the research questions. The findings of the study revealed that the primary cyber threats targeting power system infrastructure in Nigeria including network-based attacks, insider threats, supply chain vulnerabilities, advanced persistent threats (APTs), physical attacks, zero-day exploits, data breaches, and ransom ware/extortion; it further reveal that cyber-attacks on power grid infrastructure in Nigeria lead to significant service disruptions, financial losses, equipment damage, safety compromises, erosion of customer confidence, regulatory non-compliance, increased vulnerability to future incidents, reputation damage, and prolonged recovery periods, underscoring the multifaceted impact of cyber threats on operational efficiency. The study recommended that: Collaboration among stakeholders, including government agencies, industry partners, and cyber security experts, is paramount to effectively address emerging threats and enhance cyber security resilience. By implementing proactive measures and fostering a culture of cyber security awareness, Nigeria can strengthen its power system infrastructure against cyber threats, safeguarding the reliability and security of critical services for its citizens.

The Most Important Types of Cyber Attacks that France is Expected to Face in the Future and the Cyber Security Measures it Must Implement to Protect Critical Infrastructure, Telecommunication Networks and Personal Data

As the digital landscape continues to evolve, nations like France find themselves on the frontline of an escalating cyber warfare scenario. This abstract provides an insightful overview of the most significant types of cyber attacks that France is expected to face in the future, offering a comprehensive analysis based on current trends and emerging technologies. The research delves into the realm of advanced persistent threats (APTs), examining the sophisticated techniques employed by state-sponsored actors and cybercriminal organizations to compromise critical infrastructure, sensitive data, and national security. It explores the evolving landscape of ransomware attacks, focusing on the potential impact on both public and private sectors, and the looming threat of extortion campaigns that could cripple essential services. Furthermore, the abstract sheds light on the rising concern of supply chain attacks, as interconnected global networks make businesses and government entities vulnerable to malicious actors seeking to exploit weaknesses in third-party systems. The research also explores the nuances of social engineering attacks, recognizing the human element as a critical vulnerability that threat actors may exploit through targeted phishing campaigns and manipulation tactics. In addition, the abstract touches upon the growing menace of Internet of Things (IoT) vulnerabilities, acknowledging the increased interconnectivity of devices and the potential for large-scale disruptions. It also considers the implications of emerging technologies such as artificial intelligence and quantum computing in shaping the future threat landscape. By examining these diverse aspects of cyber threats, this abstract aims to provide a forward-looking perspective on the challenges France is likely to encounter in the digital realm. As Cyber security becomes an integral component of national defense, understanding these anticipated threats is crucial for policymakers, security experts, and technology professionals seeking to fortify France’s resilience against the evolving nature of cyber attacks.

ASPECTS OF FOOD SAFETY ISSUES IN MODERN AGRICULTURE

Foodborne illnesses remain a persistent public health threat, with thousands of outbreaks each year caused by contaminated produce, meat, and dairy. The study analyzed food safety risks associated with traditional industrial farming practices, including concentrated animal feeding operations (CAFOs), large-scale produce production, and nationwide processing and distribution networks. Quantitative analysis of outbreak data reveals hot spots of contamination in commodities and the food system. Qualitative research and interviews contextualize the complex contamination pathways and challenges of preventing the spread of pathogens in modern agriculture. The main risks include inappropriate manure use, contaminated irrigation water, undersized buffer zones and inadequate sanitation at processing facilities. Policy improvements related to livestock density, water treatment, and implementation of protection plans may help reduce future threats. Ultimately, enhancing food safety in a way that does not compromise productivity and affordability requires a comprehensive, systems-level approach across the farm, processing facility, and regulatory agency. KEYWORDS: food safety, foodborne illness, industrial agriculture, commodities, contamination, pathogens, policy

The Homology Determination System for APT Samples Based on Gene Maps

At present, there are fewer types of homology determination methods for advanced persistent threat (APT) samples detection, and most existing determination schemes have problems such as high cost, low accuracy, and difficulty in identifying unknown APT samples. Therefore, we proposed a homology determination system for APT samples based on gene maps by integrating deep learning and gene maps. Firstly, we extract the software gene features from the samples uploaded by the user and apply the TF-IDF algorithm to clean the extracted software genes. The Word2Vec algorithm is used to vectorize all the genes to construct the gene sample vectors. And we use a LSTM-based classifier to detect APT attack samples. Finally, the K-nearest neighbor algorithm is used to determine the homology of gene-sharing APT samples. The detailed construction process of the scheme is given in this paper, including APT sample gene extraction, cleaning, clustering, sample detection, and homology determination. Experimental validation showcases our model outperforming existing methodologies with an accuracy of 95%, precision of 94%, and recall of 95%. When compared to previous models, the superiority of our approach is evident. These results underscore our model’s high efficiency and accuracy, confirming its potential for significant application in the field of cybersecurity.

APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion

Threat actor attribution is a crucial defense strategy for combating advanced persistent threats (APTs). Cyber threat intelligence (CTI), which involves analyzing multisource heterogeneous data from APTs, plays an important role in APT actor attribution. The current attribution methods extract features from different CTI perspectives and employ machine learning models to classify CTI reports according to their threat actors. However, these methods usually extract only one kind of feature and ignore heterogeneous information, especially the attributes and relations of indicators of compromise (IOCs), which form the core of CTI. To address these problems, we propose an APT actor attribution method based on multimodal and multilevel feature fusion (APT-MMF). First, we leverage a heterogeneous attributed graph to characterize APT reports and their IOC information. Then, we extract and fuse multimodal features, including attribute type features, natural language text features and topological relationship features, to construct comprehensive node representations. Furthermore, we design multilevel heterogeneous graph attention networks to learn the deep hidden features of APT report nodes; these networks integrate IOC type-level, metapath-based neighbor node-level, and metapath semantic-level attention. Utilizing multisource threat intelligence, we construct a heterogeneous attributed graph dataset and various variant datasets for verification purposes. Extensive experimental results show that our method not only outperforms the existing methods, but also demonstrates its considerable robustness to incomplete and noise information and good explainability for attribution analysis tasks.

Detecting abnormal logins by discovering anomalous links via graph transformers

Anomalous authentications are a critical indicator of advanced persistent threats (APTs), in which adversaries exploit network vulnerabilities to gain unauthorized access and move stealthily between devices using stolen credentials. As the set of interactions between entities in a network essentially forms graph-structured data, state-of-the-art algorithms such as graph neural networks (GNNs) can be used to detect anomalous interactions that may indicate an ongoing attack. However, the success of detecting anomalous authentications using GNNs is conditioned on the representational power and performance of those models. A crucial problem is how to aggregate the node embeddings so that the GNN can better represent the network topology. Existing graph neural networks traditionally use simple functions (e.g., sum, max, mean) on the node embeddings to preserve permutation invariance and achieve consistent node representations. However, we argue that an effective aggregation of node features into a graph-level representation cannot be achieved through simple sum or mean operations. In this work, we propose a residual soft-attention scheme that facilitates the aggregation of node representations through a weighted sum, resulting in enhanced node representations and improved filtration of irrelevant information. Experimental results on three relevant datasets have shown the proposed method can detect abnormal authentications with lower false positives than competitors.

The potential of genome editing to create novel alleles of resistance genes in rice.

Rice, a staple food for a significant portion of the global population, faces persistent threats from various pathogens and pests, necessitating the development of resilient crop varieties. Deployment of resistance genes in rice is the best practice to manage diseases and reduce environmental damage by reducing the application of agro-chemicals. Genome editing technologies, such as CRISPR-Cas, have revolutionized the field of molecular biology, offering precise and efficient tools for targeted modifications within the rice genome. This study delves into the application of these tools to engineer novel alleles of resistance genes in rice, aiming to enhance the plant's innate ability to combat evolving threats. By harnessing the power of genome editing, researchers can introduce tailored genetic modifications that bolster the plant's defense mechanisms without compromising its essential characteristics. In this study, we synthesize recent advancements in genome editing methodologies applicable to rice and discuss the ethical considerations and regulatory frameworks surrounding the creation of genetically modified crops. Additionally, it explores potential challenges and future prospects for deploying edited rice varieties in agricultural landscapes. In summary, this study highlights the promise of genome editing in reshaping the genetic landscape of rice to confront emerging challenges, contributing to global food security and sustainable agriculture practices.

A Comprehensive Review on Cybersecurity Issues and Their Mitigation Measures in FinTech

The fourth industrial revolution has seen the evolution and wide adoption of game-changing and disruptive innovation, "financial technologies (FinTech), around the globe. However, the security of FinTech systems and networks remains critical. This research paper comprehensively reviews cybersecurity issues and their mitigation measures in FinTech. Four independent researchers reviewed relevant literature from IEEE Xplore, ScienceDirect, Taylor & Francis, Emerald Insight, Springer, SAGE, WILEY, Hindawi, MDPI, ACM, and Google Scholar. The key findings of the analysis identified privacy issues, data breaches, malware attacks, hacking, insider threats, identity theft, social engineering attacks, distributed denial-of-service attacks, cryptojacking, supply chain attacks, advanced persistent threats, zero-day attacks, salami attacks, man-in-the-middle attacks, SQL injection, and brute-force attacks as some of the significant cybersecurity issues experienced by the FinTech industry. The review paper also suggested authentication and access control mechanisms, cryptography, regulatory compliance, intrusion detection and prevention systems, regular data backup, basic security training, big data analytics, use of artificial intelligence and machine learning, FinTech regulatory sandboxes, cloud computing technologies, blockchain technologies, and fraud detection and prevention systems as mitigation measures for cybersecurity issues. However, tackling cybersecurity issues will be paramount if FinTech is to realize its full potential. Ultimately, this research will help develop robust security mechanisms for FinTech systems and networks to achieve sustainable financial inclusion.

Machine learning-enabled hybrid intrusion detection system with host data transformation and an advanced two-stage classifier

Network Intrusion Detection Systems (NIDS) have been extensively investigated by monitoring real network traffic and analyzing suspicious activities. However, there are limitations in detecting specific types of attacks with NIDS, such as Advanced Persistent Threats (APT). Additionally, NIDS is restricted in observing complete traffic information due to encrypted traffic or a lack of authority. To address these limitations, a Host-based Intrusion Detection system (HIDS) evaluates resources in the host, including logs, files, and folders, to identify APT attacks that routinely inject malicious files into victimized nodes. In this study, a hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. The host data undergoes a Language Processing (NLP)-based Bidirectional Encoder Representations from Transformers (BERT) model from textual representation to a numerical one in order to process host data in a similar way to the network flow data through machine learning models. The feature flattening technique is applied to flatten two-dimensional host-based features that is provided by BERT into one-dimensional vectors so that host-based and network flow-based features can be processed by advanced Machine Learning (ML) models. In order to enhance HIDS effectiveness, a two-stage collaborative classifier is utilized, which applies two tiers of machine learning algorithms, binary and multi-class classifiers, to detect network intrusions. Once a binary classifier is used to detect benign samples to reduce the complexity of the original problem, the attack data are classified by a multi-class supervised learner to identify attack types. Hence, the overall performance of the two-stage collaborative model outperforms the baseline classifier, XGBoost. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1. The performance of XGBoost, which represents conventional ML, is evaluated. Combining host and network features enhances attack detection performance (macro average F1 score) by 8.1% under the CICIDS 2018 dataset and 3.7% under the NDSec-1 dataset. Meanwhile, the two-stage collaborative classifier improves detection performance for most single classes, especially for DoS-LOIC-UDP and DoS-SlowHTTPTest, with improvements of 30.7% and 84.3%, respectively, when compared with the traditional ML models.

Beta cells deficient for Renalase counteract autoimmunity by shaping natural killer cell activity.

Type 1 diabetes (T1D) arises from autoimmune-mediated destruction of insulin-producing pancreatic beta cells. Recent advancements in the technology of generating pancreatic beta cells from human pluripotent stem cells (SC-beta cells) have facilitated the exploration of cell replacement therapies for treating T1D. However, the persistent threat of autoimmunity poses a significant challenge to the survival of transplanted SC-beta cells. Genetic engineering is a promising approach to enhance immune resistance of beta cells as we previously showed by inactivating the Renalase (Rnls) gene. Here, we demonstrate that Rnls loss of function in beta cells shapes autoimmunity by mediating a regulatory natural killer (NK) cell phenotype important for the induction of tolerogenic antigen-presenting cells. Rnls-deficient beta cells mediate cell-cell contact-independent induction of hallmark anti-inflammatory cytokine Tgfβ1 in NK cells. In addition, surface expression of regulatory NK immune checkpoints CD47 and Ceacam1 is markedly elevated on beta cells deficient for Rnls. Altered glucose metabolism in Rnls mutant beta cells is involved in the upregulation of CD47 surface expression. These findings are crucial to better understand how genetically engineered beta cells shape autoimmunity, giving valuable insights for future therapeutic advancements to treat and cure T1D.

Review of Data Security and Privacy in Cloud Computing

Cloud computing, thus, ensure more healthy demand for cloud services, certain measures against threats in order to protect information must be taken. In essence, the current paper seeks to extend knowledge regarding the improvement of paradigms of cloud computing with particular focus on the aspect of certification of authentic users and protection of the contents that are hosted in these environments. It mentions a new approach in the context of the authentication method that was deployed for the purpose of the AAA certification is presented there along with the watermarking and this RSA algorithms to enhance the security of the cloud file-sharing. This concept is far more effective than the conventional access policies that are top down and cal beforehand for systematic risk avoidance; hence, it helps to minimize the chances of an organization being vulnerable to various risks by right management. Iturbide’s data loss prevention technique eliminates the probability of losing sensitive information to the rest of the world as well as other unauthorized persons or organizations regaining access to privileged keys while Shamir’s secret sharing algorithm- polynomial interpolation ensures that the generation of keys is not a time-consuming exercise. In order to address the issues of persistent security threats in cloud computing paradigm, the proposed model includes computation, encryption and access to improve the overall security of cloud environment. However, these measures have been implemented, some of them can offer the best security when it comes to the ever-evolving threat. To maintain the privacy of clients’ data in the CL reinforcement learning, the paper suggests the use of homomorphic encryption for privacy-preserving RL inference. Therefore – as a result of the work – the necessity of implementing the suggested security model for the cloud computing environments as well as protecting the data and enhancing the level of trust in cloud solutions is stated. Keywords - QoS (Quality of Service), Energy Efficiency, Ontology, AAA (Authentication, Authorization, and Accounting), RSA Algorithm, RSA Algorithm, ReDCIM (Reconfigurable Digital Computing-In-Memory) Processor, tableopencache, LSTM (Long Short-Term Memory)

Sheep anthrax outbreak in Muddaballi Village, Karnataka, India: a comprehensive study of factors

Anthrax, caused by Bacillus anthracis, remains a persistent threat to global public health and livestock industries. This study investigates a sheep anthrax outbreak in Muddaballi Village, Karnataka, India. Muddaballi has a population of 2,450 people and a livestock population of 2,279 animals, including 756 cows, 82 buffaloes, 1,129 sheep, and 312 goats. The village experienced anthrax outbreaks in 2016, 2021, and 2023, with significant sheep mortalities: 4 out of 200 sheep in 2016, 25 out of 150 sheep in 2021, and multiple incidents in 2023 affecting different farmers with mortality rates ranging from 4 to 20 sheep. The ecological characteristics, including an average annual temperature of 27.0°C and annual rainfall of 587 mm, alongside proximity to the Tungabhadra reservoir, played a crucial role in spore survival and transmission. The study highlights socioeconomic factors and Risk Exposure and Mitigation Behaviour (REMB) as critical determinants of anthrax incidence, with farmers reporting strong agreement on the influence of these factors (Likert scale: 4-5). The integration of AI tools for early detection and rapid response, comprehensive disease surveillance, and ensuring vaccine accessibility are essential measures. Training initiatives for local veterinarians and farmers are also crucial to mitigate future outbreaks. This multifaceted approach is vital for effective anthrax prevention and control in Muddaballi and similar regions.

The Volkswagen emissions scandal: Exploring the role of environmental concern and social norms

Nearly a decade after the 2015 emissions scandal, Volkswagen has transitioned from marketing deceptive ‘clean engine cars’ to becoming a major player in the electrification of the automotive industry. Yet, the violation of environmental standards during the scandal resulted in excessive pollutant emissions, posing persistent threats to health and the environment. This paper explores how consumers held Volkswagen accountable for these hazards. Our analysis reveals that the decline in Volkswagen’s sales volumes following the scandal was driven by environmentally concerned consumers globally. However, their reaction was short-lived and mainly limited to the models implicated by the U.S. Environmental Protection Agency. Interestingly, we find no evidence of lost sales to competitors. Instead, we document a within-brand or within-group shift in favor of Volkswagen models compliant with environmental regulations. This phenomenon could be one of the contributing factors explaining Volkswagen’s resilience in navigating the fallout from the scandal.

APT Attack Detection Method Based on Traceability Graph

This article proposes an Advanced Persistent Threat (APT) attack detection method based on traceability graphs, aimed at addressing the complexity and concealment of APT attacks. This method describes system behavior by constructing a traceability graph, optimizing it to reduce redundant information, converting the traceability graph sequence into a feature vector sequence, and using an encoder decoder model to train the GRU (Gate Recurrent Unit) model to extract long-term features of the sequence. Finally, a normal behavior model is established through clustering to detect APT attacks.